# Caddyfile for headscale stack.
#
# Auto-issues a Let's Encrypt cert for $HEADSCALE_DOMAIN and reverse-proxies
# to headscale's HTTP listener on :8080. Tailscale clients require this
# exact hostname over HTTPS.

{
    email {$ACME_EMAIL}
}

{$HEADSCALE_DOMAIN} {
    encode zstd gzip

    reverse_proxy headscale:8080 {
        header_up X-Real-IP {http.request.remote.host}
        # Long-lived noise/wireguard control streams; lift the default
        # idle limit so they don't get torn down.
        flush_interval -1
        transport http {
            read_timeout  10m
            write_timeout 10m
        }
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options    "nosniff"
        Referrer-Policy           "strict-origin-when-cross-origin"
        -Server
    }

    log {
        output stdout
        format console
    }
}